skysight-inc/HackerNews huggingface dataset:
>I think you'll find in disagreeing with the comment on logic errors you just said the same thing the comment did about logic errors.

I think you'll find that my comment explicitly acknowledges this and expands on it with another example. Are we done telling each other to read the things we're writing?

>Firefox not only set out to make Rust for this purpose but it's not had an explosion in vulnerabilities with the modules it has replaced.

You're setting the bar pretty high with an "explosion" of vulnerabilities here. Rust programs have vulnerabilities, including rewrites. They also have other kinds of bugs, often ones which were not present in the code that they're replacing. You need only browse your nearest convenient RiiR bug tracker to find evidence of this.

Let me restate my thesis in mathematical terms. If we presume that 1 in 100 lines of production code has a bug in it, regardless of language (generous, I know), and that 1 in 10 bugs in C programs are memory corruption related, then saving 10% of those bugs by rewriting it in Rust would take a 10,000 line codebase from 100 bugs to 90 bugs. A 1,000 line codebase, still written in C and without the advantage of memory safety, would have only 10.

In today's example, sudo is a caricature of runaway complexity. Rust is often touted as a panacea, but C has very little to do with why sudo is insecure. Sudo is comically overengineered and that level of overengineering has no place in a security context. This is the larger issue that needs to be addressed, not Rust.
The point is obvious.
This is not science but politics.
> We don't have to rewrite everything in Rust to get better security. We just have to use simpler tools.

People don't add these features for the fun of it; they're present because they solve a specific use case.

I use doas as well; it's a neat little program that covers many of the common use cases, but it doesn't cover all of them. Usually you should use the simplest tool that solves your problem, but sometimes your problem is complex and thus your tool will be complex.

That is not to say that sudo can't perhaps be simpler; the first version was released in 1985 and there are probably things that can be improved, but sudo really isn't written by idiots who just add features because they have nothing better to do.
driving a car does not, by itself, cause car accidents
Sometimes I wonder if playing with old obviously obsolete computers is a waste of time.

Been working on replacing the BIOS on a 386EX single board computer with a custom monitor / "hypervisor" I'm writing in Rust as kind of a demonstration of how low level you can get with Rust. I want to post a Show HN after cleaning it up a bit.
Conspiracy theories are more fun to read.

One thing they always fall down is the idea that government bureaucracy is so quick and competent that they could do something like installing mass surveillance at a moments notice while the country is in chaos without it leaking due the next 20 years
This is great. It's appeared before in HN, and I'm glad to see it again.

https://news.ycombinator.com/item?id=22328516
It is, but also isn't new.
It genuinely takes a massive amount of labor using mostly highly paid professionals like doctors, nurses, and research scientists. Even before any trials start, the support materials for a premarketing application for a drug are usually in the thousands of pages and include clinical trial protocols that describe minutiae like how blood samples will be drawn so data is comparable between hospitals. Then you have to find participating hospitals, PIs, and patients which means lots of negotiation and patient screenings and TV/radio/web advertising. Then you have to manufacture the drugs in small to medium quantities. Then you have to actually run the trials which means paying a lot of people and most if not all of their medical care related to the clinical trial.

Phase I trials, for example, are usually carried out under constant medical supervision and push the dosage as high as they can until 50% of the cohort will no longer tolerate it. That alone is usually thousands or tens of thousands per day per patient.

By the time you get to phase III where you have hundreds to thousands of patients, you're shelling out up to $1k per patient for the incentive and $100-1k per checkup for the length of the trial. A 1k person phase III can easily cost tens of millions in labor just to administer the drug and collect samples once a month for a year. Data provenance and normalization is important so a not insignificant chunk of this time is largely unavoidable paperwork.
> "the Firefox apologist mob"

You can't possibly be serious....
Yes it was and yes it is. Developers can write apps that make use of a stable database instead of rolling their own INI file read/write routines. This makes more apps stable, which is great for users. This is something programmers really don't understand (considering every programmer I talk to uses the registry as an example of Microsoft's stupidity and heavy-handedness), which is unfortunate. We should spend more time thinking about our programs as wholistic experiences for the user, not just "is INI file or registry more elegant in my idealized world".
Canada, with universal healthcare has about the same number of new cases per capita.

So it’s not access to care.
It can "detect" if JS is disabled (by loading content via JS) so this doesn't always work.
Editing tweets to me is not just a feature, it's a fundamental shift to the nature of the platform. Even bigger than doubling tweet size did.

Twitter is defined by tweets not being polished Facebook or LinkedIn posts. Except for people who don't use it that way, but they feel artificial to me. I'd rather all of Twitter not drift that direction.

And personally, I love that I can't worry about fixing typos. If they're bad enough I delete. If not, move on, stay humble and pay more attention next time.
> I'm unsure how to handle this.

I also. I'm fairly sure it's a compliment, though, so thanks!

> it's remarkably shorter than an old-fashioned LCD alarm clock in which an alkaline battery could last for months.

It certainly is, but an LCD alarm clock is much less fabulous, since it has to be pressed or otherwise activated to produce light, and that's my main need here (a clock that I can read in the dark without moving).

> it's remarkably shorter than an old-fashioned LCD alarm clock in which an alkaline battery could last for months

That's a good suggestion, but it loses some of the "set it and forget it" factor, and I will very definitely forget it (especially when there's no low voltage warning). I have some ESP32 boards with a built-in charger, so that's more hands-off. Also, the length of the clock is shorter than a 18650, so I'd have to make the clock larger and the screen would look even smaller in comparison. I appreciate the suggestions, design is fun and getting feedback from others makes it even better!

> cheap LiPo pouches have an annoying tendency to puff up and go bad

Oh, don't worry about that, they're all already puffed up.
They got to the end of their financial year and had $$$ left to spend... happens all the time.
Evcxr: A Rust REPL and Jupyter Kernel
If you predict hyperinflation then which goods do you think will we have a shortage of? Because that is what inflation is. Too much spending and not enough things to buy.

post WW1 Germany both had a broken economy and a massive amount of foreign debt. What makes you think that similar events will take place? What prevents the economy from simply recovering in 1 or 2 years?
You are definitely correct and thanks for pointing it out. Generalizations and miss-information doesn't help at all.

I obviously need to go out for a walk before I comment on these type of news. It's super exciting but also extremely depressing since the ones who'd need this the most likely wont afford it.
Facebook user's phone numbers are for sale
A Wall Street Trader’s View on Bitcoin’s $1M Valuation
This makes me appreciate our moon.

How lucky we are to have a moon that is roughly the same size in the sky as the sun is -- aligned such that we occasionally get to see a perfect solar eclipse and the sun's corona with our naked eyes.
Your pricing page does not have any prices so it's hard to tell. I'll definitely keep an eye on your progress though.
Your connector as container approach is interesting although i think IT departments may have issues with an on prem solution that spawns other containers by itself.

One more thing - how will you protect yourself from let's say AWS forking you and selling a managed airbyte version?
a) posix doesn't guarantee or require it b) ext4 actually provides a workaround for that kind of broken software with its auto_da_alloc behavior, which is on by default.
Thanks for the reminder that I hadn't enabled this in my current browser :)
Adding features because they solve a specific use-case is grossly irresponsible. Solving a specific use-case is only one of many criteria that needs to be met for a feature to be justified. Others include "is it in scope?", "is it a maintenance burden?", "does it make existing features more unreliable?", "will its bugs affect people who don't need it?", "can it be done in a separate tool?" Anyone can come up with a use-case. It's often the maintainer's job to say "no".

If doas doesn't cover your edge case, then the responsible thing is to make a new tool which covers just that, and not to shove your complexity into a critical security component that the other 99% of the userbase doesn't need. Remember Heartbleed? The entire internet shat its pants because of a vulnerability in a feature that no one uses.

Failing to uphold that principle over and over again leads to broken, unreliable, insecure programs. This is why everything is on fire. Not C.
If that website doesn't ask me if I want to allow those trackers then it's forcing them upon me without my consent. How am I supposed to know if a website has a tracker before I visit it?
I have GPD P2 Max, the keyboard is ok for typing letters, but punctuation requires special key combos, and symbols used in programming like brackets underscores, commas, plus, equals, etc also have unusual key combos. I’ve been unable to use it for any meaningful programming work.

The fan is also loud even on quiet mode settings. You need to underclock it to reduce fan speed to what my opinion is comfortable for working in a quiet room.
The Rise of Rocky Linux
You need a longer FFT window to discern lower frequencies. Assuming a 44.1k sample rate and the default window size of 4096, you only get 10Hz buckets. Given that the low E is 82Hz, you effectively can't distinguish it from the D# at 78Hz and the F at 87Hz
That would be something... especially given that absolute zero, the lowest temperature possible when matter ceases movement is -273C.

It’s a funny typo. Always makes you wonder how much other stuff they get wrong that’s missed.
Eliminating the bronze-tier sounds foolish to me. I’m a bronze customer, and I’m definitely not going to opt to pay for a 5x price increase, because I don’t need all those extra bells and whistles.

Getting funding to pay for something that has free alternatives is already difficult in corporate settings. Having your cheapest (non-free) option be $228 per user per year is a pretty hard sell, especially for those self-hosting Gitlab.

Super annoying to have all the bells and whistles they keep adding being used as a justification to jack up the prices when you don’t actually use those bells and whistles.
I think the design of the relevant code is worse than the lack of relevant test coverage. The problem solved insecurely by the code instead seems like an obvious target for lexical and syntactic analysis (and this has been so since the sixties, I think).
Also OSMGo for adding new points to the map https://osmgo.com/ I have both on my phone, Street Complete and OSMGo
They're likely a little swamped with the Pico launch.
So you're suggesting some sort of servo-controlled horse blinders, interesting.
GitLab doesn't own Azure - they rent. Either they get repos in every major cloud data center or they lose on network transfer latency/cost.
Terrible presentation
Another question is who wants to maintain four decades old GNU C soup? It was written at a different time, with different best practices.

In some point someone will rewrite all GNU/UNIX user land in modern Rust or similar and save the day. Until this happens these kind of incidents will happen yearly.
Understanding GPU Caches
Your comment ignores everything the article talks about.

The Registry could have been designed to be a standard settings store but without the drawbacks of being monolithic, not human-readable, and being one giant point of failure.
Yes, there is the potential of an rsync.net account being used as a "seedbox" - as the young people call it.

However, even our discounted pricing is more expensive than the cutthroat seedbox provider pricing that we see out in the world - so I think serious folks will use rsync.net accounts for brokering data like this, but the datahoarder crowd will store their petabytes elsewhere.

Also, we have recently turned up multiple 10gb pipes at he.net which we found to be very affordable in 2021 so, at least for now, we have bandwidth to spare ...
I think the first email was ~8 months ago, but I don't know how long the Pico launch has been brewing for.
The voice of the customer in digital-product design
He shows up in a William Gibson novel, in the Neuromancer series.
More CVEs can also sometimes be a function of exposure; Joe Random's program probably has no CVEs but that doesn't mean it's more secure than Jane Popular's tool. In this case, however, both sudo and doas have sufficient exposure to estimate their relative security using CVEs. We can also use the CVEs to characterize the kinds of vulnerabilities each has internally, without comparing them to each other. In general, the CVEs that are discovered for sudo are more severe and damning than those discovered for doas, without respect to their relative occurance.
How I made and launched a Shopify app while working full time
I'd be willing to bet (a very small sum) that the HTTP 0.9 and 1.0 servers encountered are app servers/frameworks. They're simpler to implement than HTTP 1.1 and don't set expectations on the client they can't meet.

When you've got a fleet of machines behind load balancers you don't need things like a Host field to support vhosts since it's one site to a host. You also don't need pipelining because each connection is a one and done operation.
I was under the impression Firefox on Windows only updated before starting (and maybe after stopping) and on Linux, the updates are managed by the system.

I don't use Windows much these days, but I'd love to know which setting it is that turns this off as I tend to hoard tabs and this sounds extremely annoying.
Enjoying yourself is never a waste of time.
We’ve recently been surprised by wrong estimates made by the planner resulting in inefficient query plans.

It seems that power law distributions over multiple tables aren’t handled very well: https://stackoverflow.com/questions/65861780/is-there-a-way-...
https://astralcodexten.substack.com/p/logistics

> I'm saving the Substack mailing list regularly to my hard drive, and if I go somewhere else I'll let you all know.

So this is possible on Substack at least.

Some Substacks also use a custom domain name, which would make migration off the platform even easier.
I loved mine at least a year and was quite happy for another year. Some sites worked awesome, others sucked hard due to crazy pay loads.

I blame shitty sites more than Apples architecture :(
The article doesn’t say large fan bases are useless, just that managing them requires a different skill set (and possibly personality type) than conventional team management or pure dev work.
Just FYI, notice the configurable "Sensitivity" setting. The default of 12 let's you miss by about a quarter of a tone (half step) either way.
Id say selling naked calls is the real fraud here.

Why is it the fault of wsb for exploiting a market failure?
> Preliminary investigations conducted by the Chinese authorities

Right it doesn't matter who looks, just that someone does. The Chinese looked! And they didn't find any evidence of human-to-human transmission. That is evidence that there isn't any. Not very compelling evidence but still evidence.
That's not what WSB is doing. The traders charged by the SEC were acting in coordinattion to drive stock prices up and down with manufactured orders.

On the other hand, WSB is just a bunch of different people and a lot of them have bought GME because they thought would go up.

By your logic, anytime a stock goes up, how's it not just manipulation? It's typically caused by a bunch of people buying it cause they hope it will continue to go up. This is all that's happened at WSB.
The free tier users? I'm amazed actually at what the free tier offers to small startups. We have hundreds of gigabytes worth of docker images in the gitlab package registry that we can't even delete/cleanup properly (just keeping the last two would do for us), and Gitlab is keeping all that data for free.
How are people getting rich over this? Buying GME calls and hoping they appreciate?
You must have a very pure voice!
Yea. Love gitlab but the pricing does add up quickly. Even if with all the features, it's really hard to get value out of Gold/Ultimate.

When I add up all the major SaaS apps an average user has: SSO, Email, Chat, Storage, Zoom, Support. Combined, GitLab Ultimate costs 2-3x that. And I promise you that as much as we all hate a messy inbox, email is more broadly useful than GitLab.

The other problem with ultimate is that it strongly incentives you to NOT let anyone else on the platform. At $1200/year there is no way in heck I'm letting the artists use Git, they can stick to their terribly Dropbox hacks. Marketing team working on assets with developers? Use email, no way you're getting access to GitLab. The $100/user/month model makes sense if they are a core developer (still too expensive, but makes sense) using every single feature in the system, but nothing else.
> I failed to grasp what it is

It queues up Unix (shell) jobs. Do you understand what's meant by a shell "job"? Like "cmd &"?

Typing "cmd1 &", "cmd2 &", etc, runs jobs in parallel. "nq cmd1", "nq cmd2", runs them serially, in a queue.
Historical Dictionary of Science Fiction
Naver AI Lab Researchers Relabel 1.28M ImageNet Training Images
The attack on spacex at the start - the one company that’s actually likely to put sky at night readers on Mars - took me out of it before the 900C hilarity.
Did they charge you upfront for the installation?
1000$
There is also a lot more research, see: http://www.myopia-manual.de/private/manual-2021-jan.pdf

>The development of chicks towards emmetropization was observed at various levels of illumination: (10.000 Lux, 500 Lux and 50 Lux). Result: After 90 days 50 Lux resulted in a mean myopia of –2.41 D, 500 Lux resulted in +0.03 D, and 10.000 Lux resulted in hyperopia of
+1.1 D.

>"Categorized according to their objectively measured average daily light exposure and adjusting for potential confounders (age, sex, baseline axial length, parental myopia, nearwork, and physical activity), children experiencing low average daily light exposure (mean daily light exposure: 459 ± 117 lux, annual eye growth: 0.13 mm/y) exhibited significantly greater eye growth than children experiencing moderate (842 ± 109 lux, 0.060 mm/y), and high (1455 ± 317 lux, 0.065 mm/y) average daily light exposure levels."

>for myopic children 6 to 12 years old a mean progression of – 0.35 D in winter and –0.14 D in summer. This was attributed to the children's extended time spent outdoors in summer

Getting more sunlight is the most helpful thing one can do without special equipment
The GNU project is wall-to-wall toxic waste, but I note for the record that I don't think sudo is a GNU program and IIRC it's not even GPL.
It is hard to fathom how much money ppl are making with options on this. I have never seen anything like this. It is like everyone is becoming multi millionaires on walsltreetbets. Like the fakebook IPO or What's App acquisition, when a bunch of people suddenly became millionaires. It is probably keep going up. This is the stuff dreams are made of, the stuff of legends. People think it cannot happen but then it does.
Yeah, $5Bn may be a bit of an exaggeration, but it's not off by an order of magnitude; this review, based on data from Eli Lilly, put the fully capitalized R&D number at $1.8Bn in 2010:

https://www.nature.com/articles/nrd3078

(one can certainly quibble over the "cost of capital" assumptions these days, but the model isn't wildly wrong.)

> That billion dollar figure is risk adjusted per product meaning that's the cost of all R&D and clinical trials against the number of products that hit the market.

Yes, but as you know, you can't simply separate the successful products from the ones that fail. The former pay for the latter.

> A lucky startup can pull off a successful trial for a few hundred million (i.e. Sofosbuvir), if not tens of millions for an orphan drug.

Sure, one can always hit the lottery. But unlike startups (where the N-independent-failures model works OK), drugs don't make it to market without a deep-pocketed company willing to set huge piles of money on fire in the final phases.

Your other comment below does a good job of explaining why trials are insanely expensive...which is why lucky startups almost never run their own. So you're dependent on a system where deep-pocketed mega-corporations need to exist simply to get the drugs on the market, and they are reliant on massive returns to take the risk in the first place.
Ah, to be young again!
FFT is configurable at the bottom of the page, but for me it gets unpleasantly laggy if I make it bigger than 4096
Also, it's more spherical than the moons of Mars.
Gravity sketch does this in their paid plans
I wouldn't be surprised if their licensing terms require your chip to pass some kind of compliance test for the standard ISA, but probably only the licensees know that. I'm sure you can't use the ARM trademarks if it isn't compatible thought - that's pretty standard.
Obligatory, but this really seems to confuse the point: their revenue doesn’t come from their users at all. It comes from selling their users to advertisers.
Funny, when I read that part my reaction was "this has to be a joke".
You can read a bunch about how we made that decision here: https://about.gitlab.com/handbook/ceo/pricing/#price-differe...
I did not downvote you, for the record. I thought your questions were useful and I hope I answered them to the best of my ability.

This pandemic has been hard on all of us. Take care.